hxxps://vaultcord[.]win/deathubb

Analysis

user interaction
yes
max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://vaultcord.win/deathubb
Sample260810-vr7mbstenh

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4580	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308556811664459"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{2D06FABD-31D0-4BA4-AD8F-8E81C8AA5986}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 5892	4512	msedge.exe	88
PID 4512 wrote to memory of 5312	4512	msedge.exe	91
PID 4512 wrote to memory of 4580	4512	msedge.exe	90
PID 4512 wrote to memory of 5312	4512	msedge.exe	91
PID 4512 wrote to memory of 5312	4512	msedge.exe	91
PID 4512 wrote to memory of 1788	4512	msedge.exe	92
PID 4512 wrote to memory of 1788	4512	msedge.exe	92
PID 4512 wrote to memory of 5888	4512	msedge.exe	94
PID 4512 wrote to memory of 4744	4512	msedge.exe	95
PID 4512 wrote to memory of 5888	4512	msedge.exe	94
PID 4512 wrote to memory of 5888	4512	msedge.exe	94
PID 4512 wrote to memory of 4744	4512	msedge.exe	95
PID 4512 wrote to memory of 4744	4512	msedge.exe	95
PID 4512 wrote to memory of 1460	4512	msedge.exe	97
PID 4512 wrote to memory of 1460	4512	msedge.exe	97
PID 4512 wrote to memory of 1460	4512	msedge.exe	97
PID 4512 wrote to memory of 4260	4512	msedge.exe	96
PID 4512 wrote to memory of 4260	4512	msedge.exe	96
PID 4512 wrote to memory of 4260	4512	msedge.exe	96
PID 4512 wrote to memory of 4808	4512	msedge.exe	98
PID 4512 wrote to memory of 4808	4512	msedge.exe	98
PID 4512 wrote to memory of 4808	4512	msedge.exe	98
PID 4512 wrote to memory of 5300	4512	msedge.exe	100
PID 4512 wrote to memory of 5300	4512	msedge.exe	100
PID 4512 wrote to memory of 4388	4512	msedge.exe	101
PID 4512 wrote to memory of 4388	4512	msedge.exe	101
PID 4512 wrote to memory of 800	4512	msedge.exe	103
PID 4512 wrote to memory of 3432	4512	msedge.exe	107
PID 4512 wrote to memory of 3432	4512	msedge.exe	107
PID 4512 wrote to memory of 3432	4512	msedge.exe	107
PID 4512 wrote to memory of 2524	4512	msedge.exe	108
PID 4512 wrote to memory of 2524	4512	msedge.exe	108
PID 4512 wrote to memory of 2524	4512	msedge.exe	108
PID 4512 wrote to memory of 1264	4512	msedge.exe	109
PID 4512 wrote to memory of 1264	4512	msedge.exe	109
PID 4512 wrote to memory of 1264	4512	msedge.exe	109
PID 4512 wrote to memory of 3388	4512	msedge.exe	110
PID 4512 wrote to memory of 3388	4512	msedge.exe	110
PID 4512 wrote to memory of 3388	4512	msedge.exe	110
PID 4512 wrote to memory of 2948	4512	msedge.exe	111
PID 4512 wrote to memory of 2948	4512	msedge.exe	111
PID 4512 wrote to memory of 2948	4512	msedge.exe	111
PID 4512 wrote to memory of 3644	4512	msedge.exe	113
PID 4512 wrote to memory of 2596	4512	msedge.exe	114
PID 4512 wrote to memory of 1220	4512	msedge.exe	115
PID 4512 wrote to memory of 5444	4512	msedge.exe	116
PID 4512 wrote to memory of 5444	4512	msedge.exe	116
PID 4512 wrote to memory of 5444	4512	msedge.exe	116
PID 4512 wrote to memory of 3928	4512	msedge.exe	117
PID 4512 wrote to memory of 3928	4512	msedge.exe	117
PID 4512 wrote to memory of 3928	4512	msedge.exe	117
PID 4512 wrote to memory of 2296	4512	msedge.exe	118
PID 4512 wrote to memory of 2296	4512	msedge.exe	118
PID 4512 wrote to memory of 2296	4512	msedge.exe	118
PID 4512 wrote to memory of 4556	4512	msedge.exe	119
PID 4512 wrote to memory of 4556	4512	msedge.exe	119
PID 4512 wrote to memory of 4556	4512	msedge.exe	119
PID 4512 wrote to memory of 5760	4512	msedge.exe	120
PID 4512 wrote to memory of 5760	4512	msedge.exe	120
PID 4512 wrote to memory of 2984	4512	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://vaultcord.win/deathubb
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x268,0x26c,0x270,0x264,0x244,0x7fff02f9c188,0x7fff02f9c194,0x7fff02f9c1a0
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,8100590016755840370,6427967451594738925,524288 --field-trial-handle=2584,i,15499557279491118102,15691352643020336878,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,16004584431733521056,15499950106210686215,262144 --field-trial-handle=2584,i,15499557279491118102,15691352643020336878,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:2
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,18202390185498541096,10031747372433505664,524288 --field-trial-handle=2584,i,15499557279491118102,15691352643020336878,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:13
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,11756618889939825638,2027294411648528526,2097152 --field-trial-handle=2584,i,15499557279491118102,15691352643020336878,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,16858279921577637692,8617620397429062287,2097152 --field-trial-handle=2584,i,15499557279491118102,15691352643020336878,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,14293964429686710962,13909190904894820905,2097152 --field-trial-handle=2584,i,15499557279491118102,15691352643020336878,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,2755742674856733252,15933007735639631768,2097152 --field-trial-handle=2584,i,15499557279491118102,15691352643020336878,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:9
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3536,i,9472294604660470950,15591416562444116162,2097152 --field-trial-handle=2584,i,15499557279491118102,15691352643020336878,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,13818168305390987187,4275091362068712192,524288 --field-trial-handle=2584,i,15499557279491118102,15691352643020336878,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,15247373782448713629,9667653770748257962,524288 --field-trial-handle=2584,i,15499557279491118102,15691352643020336878,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,14560310566439889783,2629352725913794408,524288 --field-trial-handle=2584,i,15499557279491118102,15691352643020336878,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,14560310566439889783,2629352725913794408,524288 --field-trial-handle=2584,i,15499557279491118102,15691352643020336878,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6136,i,12533688683675688907,6859756381348602293,2097152 --field-trial-handle=2584,i,15499557279491118102,15691352643020336878,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6640,i,1396291122497337727,1202620077395165800,2097152 --field-trial-handle=2584,i,15499557279491118102,15691352643020336878,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6892,i,16077152533329721077,15146309368555601546,2097152 --field-trial-handle=2584,i,15499557279491118102,15691352643020336878,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4384,i,6379478418408265066,11864576941041448981,2097152 --field-trial-handle=2584,i,15499557279491118102,15691352643020336878,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6584,i,17388107062002484561,5876067450512167827,2097152 --field-trial-handle=2584,i,15499557279491118102,15691352643020336878,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,5855431949093538390,2792068496403819039,524288 --field-trial-handle=2584,i,15499557279491118102,15691352643020336878,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,9265624200234033245,4015936053375964330,524288 --field-trial-handle=2584,i,15499557279491118102,15691352643020336878,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:14
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,8208374491297680629,2156072161015445011,524288 --field-trial-handle=2584,i,15499557279491118102,15691352643020336878,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5524,i,12861842662948299424,13167331382761391551,2097152 --field-trial-handle=2584,i,15499557279491118102,15691352643020336878,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6940,i,12267176818762521088,12478793970728016108,2097152 --field-trial-handle=2584,i,15499557279491118102,15691352643020336878,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6900,i,10611048069555520463,17716518932022311745,2097152 --field-trial-handle=2584,i,15499557279491118102,15691352643020336878,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6724,i,16496284184978888566,8230595432923873680,2097152 --field-trial-handle=2584,i,15499557279491118102,15691352643020336878,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,10319003184048084096,16127645031792468987,524288 --field-trial-handle=2584,i,15499557279491118102,15691352643020336878,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5404,i,1129539320143363394,6489399957040996958,262144 --field-trial-handle=2584,i,15499557279491118102,15691352643020336878,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 8b3137dfdf7de26188619c53f3d369f8f9a3e3633dccb2b11666f2ed6fc5551b
MD5 587394c116027250c48f83a8c554dc7f
SHA1 9f130bf42850bf1e4c22e71952f5060f1f3619a6
SHA512 7168ecb7e0d503b141c2d074ea27260fafe6b2411e2293a92ae3a635f57e960d4fc018a25e2756c51095693190a5a6de2f36606a3096027e5f2ec82e7c9b9e22
SSDEEP 96:Kivmywtg7b/Sza3ldNaW6YmIPjNSe/Ztb4ieCE133zNM:OzaHNauxS+b4Xe
TLSH
T1ED9193880FED38E6DB6862B852DCCCED3671FE76090B5E0307B65DB4944F3C464A9A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a69d7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a69d7.TMP
Size 3KB
SHA256 086002f93ae64a7cb276f16d7205c4d4996ad186a29777f68ac2fba0efc8326f
MD5 1eabf1e653ea6a7b306fc942c6d967b4
SHA1 7ea6cb2a5cb905cd09102895d1fb263105b8d1f9
SHA512 aa73f2037c73c55523956a798979cf0b904748bec613279290fd55a1baf4a09bae834eeca0393d761d23aa1c7a556acfd6311542acdc241b247fd0077143239d
TLSH
T1686130540BEE39EBD76863B851ECCCDD39B2BC5909572E1315B76A38849F30860CC938
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10d5b777-8572-40e3-aa81-a28a039e7d20.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\10d5b777-8572-40e3-aa81-a28a039e7d20.tmp
Size 13KB
SHA256 50f95ca61113ec6d0e461cc4f4424c841c19329230aece7526e4b923ad185498
MD5 7e9b8a27552fb31bdfab1dd665a03240
SHA1 16c195665c654e893599384be5392df1f02f682a
SHA512 bc2fb98eb050e93dbc3a1e0fe4f9e88a2bfd083bed66d5cbb9771f717e43ef9531aaae67f405ac19f706051b702ccee5eb46cd2b7c4a903d4cd959a39f99112b
SSDEEP 384:DOwWfxD7oNaPgP1P+P0PvEPTP2cJ0UPgb1cr91mcxamwmFDwnOPfIP/GPjPkmPJe:gOVsaSD74AxFfW/0TkUhj2JmCvrVECxJ
TLSH
T19552BFB7C2E5862DC82256F59B157F1BCE1E1E18432C3C3ACAD5AF4BA7D2471E20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5bb373352cd260ad5e5b4fb9b0d6897d350d9d609db59b6879c479b30e08f370
MD5 c5b3ffb854712316525ac39b220c27a8
SHA1 079252387b45d12dec26cbc596916ef5c2e27851
SHA512 295c2c2102d6165a2b0636730e18e1325dede3f7f1e6d1b2e1f48781736822e6dc7088beb77575cd9ff3157f304a0e942e6fd88b1e3279d87edd6a4dbab0a6c1
SSDEEP 192:sxRiRKbl/f1sPTsmZMzoA8pEXO/g6+WNSRn/YxsljJEGUIgDdJ:sxRiyl/f1sPTL7/5g/7Yb
TLSH
T19F42C8566938A93B8CCAD21DFB55BF53E6F91032A0D41E54A6FC9A1C04E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 34fd4f9024e15536154c4aa518cd8b28f34e932f978cdd8a4c39b5bc3428ab05
MD5 f1662131e1a7b6c2fbc89f9ae0faaf2c
SHA1 a398bc297798463f37f3ac9ce039f6358cf5f80c
SHA512 4bd92f5b80be6b6ea91d9573c9a435ccb744aab5f25cd62d3eede85a2602e7b200938affefcc4578a3a3337052ae1bb95117955c7fcb633bc7854a961f228dba
SSDEEP 192:sxRlRKbl/f1sMTsmZFzoA8pEwd/g6+WNSRn/YxsljJEGUIgIJ:sxRlyl/f1sMTep/5g/7Ys
TLSH
T18D32C8556938A9378CCAD21DFB55BF53E6F91032A0D41E54F6FC9A1C04E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 dd03ee0ec6c13ed47340504980978133131913f00d0a09c053220f7f639886c5
MD5 d22aa1735dc3742a8ef9c6706915f0d8
SHA1 a299f12369fa03586c9f5ff39fe9d9f7c0e5ba3a
SHA512 288bfceef248cfa2eef73ce38fd00e22ae8cc80a8ff1e8ee1fbf3f7fcb487e96340648f1ff74f6c37a79feddfacbd37f9863436b554943af8a956a457f304e75
SSDEEP 192:sxRiRKbl/f1sPjsmZ9zoA8pE9pv/g6+WNIqRn/YxLlVJEGUIgDzJ:sxRiyl/f1sPjS8/5t/GYJ
TLSH
T18A42B6566938A93B8CCAD21DBA55BF53E6F91032A0D41E54ABFC9A1C00E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 b4efb0291d33518ab893418156b8a5047f5277e1d1249e128317e72c26939a0c
MD5 16a8f87cb4de9d5a3d9d71bdc7cc34b3
SHA1 fe49ca51be953c04b06895315b2e1f3e23a9af10
SHA512 d1e373fbd02ac463c9b9fa12b4c9dd831645d6e010c4dc197091d7259585143bf33fbb19e81bd5e2865fe0584e16fc69a865a6e60828f68be9063d507ce85e3c
SSDEEP 384:0OxEyGzfCtgbpFfp1KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVht9V3RkLrorut:0YEyGjWgbrfp18F1+UoAYDCx9Tuqh0VT
TLSH
T15BB2DB3B604CCB7E9F804AADAC596FD77D9802C796988D4047FE990C03C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 83817d624e6eca052189b3ba1f14774cc06bf1659fbcaea0ec05d49c478d5df0
MD5 12f4d9a6af8b6822d27e6dbd1877352e
SHA1 21aa7a5a74fe742660b6c3abd5ea8d66ab94a4f6
SHA512 25d03cb345888a980823c818e01a51f57957ba0429d43ab2ab31b5d5b75e95e0daa4deffe7815cbc8aab6ee76e0e33c458dac4d22916e78018dc9b6d77c6c0ce
SSDEEP 768:Yrv+4UNbdp32IkKL21jF669yrqUjWiIwwxMtuUileq:Ybsb33utjF66INWZTMkUsR
TLSH
T1B513CF70AC68A9B7CDF6D682B1133683BFB8515382C50F98C6CD660D069F0DD2747A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 4f98a39fd10e841015de69a80ea2c0cca235aeac52d6d7a3fc70a256f4665b8d
MD5 b7333f25a5b0a8c9031c089458f25344
SHA1 de11883fbffe66c4a3a2ec574e453e5d2db9ba61
SHA512 13b4e8b918ff0b029f002ad9feeef4b82b400cf872912596a0b7786827562519d8bfe7c97bd425903345546307041717a258ee2cfede94b3bcffdcf1827f76f7
SSDEEP 768:go3bInkKL2wLF669yrqUjWiIwwxMtuR3p:go3bILF66INWZTMkj
TLSH
T13E035BF068E75977C8EE9743633E2E42AEBCC153B1840A54B7C8660DCD5A1BFD247826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 95982f0101e196e4428ac97246c660ac232f0662648d44b88da2b5110ab0d1bc
MD5 f9b06e6bb92036c2b46c4c74b883d21a
SHA1 9e08ba8d908c4adcc622c5804d0b66cc54e7efcc
SHA512 99200851ddd251cc0c4df85470e8c79a3e15d01d92739079c82f708b7d9a43fa06610ad45b404d35a656334e8d3cb9e2b4ad0386cc59dccbf653cce0348ad41c
SSDEEP 768:Erv+4UNbdT3mInkKL2SnF669yrqUjWiIwwxMtuR3k:EbsbJ3mKnF66INWZTMku
TLSH
T15C137CF0A8E75577C8EE9743A33E2E426E7CC157B1850A54B7C8660DCD4A0BFE207826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 95c0b34825fc012e4439b403b617e7020487f4299196de324f35e5c92976caa3
MD5 3a2ac2856f2f48866bb2e2f110136659
SHA1 5f588e76cf082ba96d111015bc461de0d12f2e4c
SHA512 10613090520b7514f7a668d7fa6815008b8579234262cd3132b8f54058ea10eec971a96d6309e71f237d7551e5d13999666e952d422be2b810742b7e2b525429
SSDEEP 768:8rv+4UNbdp3VIkKL24jF669yrqUjWiIwwxMtuUileX:8bsb339AjF66INWZTMkUsQ
TLSH
T1E813CF70AC68A9B7CDF6D686B1133683BFB8515382C50F98CACC660D069F0DD274792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cceea05dca37d36974a6be8bf8dba4aa42e0f2f750d21be90198fffc27968aaa
MD5 38fbf366ea2e092b8fe263d8fdbb248c
SHA1 51903877072e2dd165c332c1c6be6d30dd11fa81
SHA512 faa951f38d0c6aaaed4e897ba6f75df49b83c20deabdba0a6d7d0082d5e79a5716992c6df9483aa410781afef1d4f8c39d03c8a2a84e3325218645e02bdf1fe4
SSDEEP 768:arv+4UNbdl3JPkKL2wjF669yrqUjWiIwwxMRJpUiler:absbX3GIjF66INWZTMxUsQ
TLSH
T17903CF34AC589AB7CDF2D68672533783BFB4119392C50B98CADC670D469B0DD2347A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 350b0af783761487606a4822b263c738fb67ab88768fe0d8e9fb9ce1e8ec5efd
MD5 a92cfb8772454567f5dbf0520a30f51a
SHA1 890af8c6abcf6703991fe4dd160fbec575fd2187
SHA512 063bfa2cf50ebe023d70397001119f9d66ed629665aa272936449140cc10070a0816fb28de3aa7ba1abfda733af98593dedfa21242b4790bc982f61b6e99be11
SSDEEP 768:Vrv+4UNbdl3ZSkKL2pjF669yrqUjWiIwwxMAuUiler:VbsbX3jRjF66INWZTMzUsQ
TLSH
T14D03CF70A86899B7CDF2C686B1533683BFB4519392C50F98CACD270D469B0DD2347A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ce1fff006bd726a65afc6ca4c23526a693596dcddb1fd95411f8c00d7b44c948
MD5 2d8de2ba6977e4030418a32d08bf8ef0
SHA1 6348cc9a4e2c243a190d28b3f0e8566b01a70f14
SHA512 f6b46ce84203cd9f02e14d5e73f3dac8e74da48d45f89379d72eaafa00fbe9b3a1e52d67e37f7b4ce75ecdebc1af59727cb37b23a1b1695af691011b7a6de087
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5a0b0d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a0b0d.TMP
Size 392B
SHA256 f752ee8b1dafa33345b42afae9b0678f71ea974e7924cc4f9e6a44290df11c5b
MD5 883b51af26283084aa264d9299e88aca
SHA1 518c0f175420dfb963a350e37da4bb4cb981153c
SHA512 1ad0483a2a20a640137a318d586e0dd128cfe4ab6a3dba478ee0847c65d36575c922607c820b5ec75eced508728579c52d521e554808b137c795e07e7072a9b0
MD5 SHA1 SHA512

Submit Download

399a9530-8cea-4068-aaf9-e411a4f20e54.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\399a9530-8cea-4068-aaf9-e411a4f20e54.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download